### Steps to reproduce

1. create a file called `.htaccess`
2. get a direct upload token: Begin of the insertion``` TOKEN=`curlEnd of the insertion Begin of the deletion TOKEN=\`curlEnd of the deletion -u admin:admin Begin of the insertionhttp://localhost/nextcloud-server/index.php/apps/integration_openproject/direct-upload-tokenEnd of the insertion Begin of the deletion http://localhost/nextcloud-server/index.php/apps/integration\_openproject/direct-upload-tokenEnd of the deletion -d Begin of the insertion'{"folder_id":2}' -H'Content-Type: application/json'End of the insertion Begin of the deletion '{"folder\_id":2}' -H'Content-Type: application/json'End of the deletion | jq .token Begin of the insertion-r`` ```End of the insertion Begin of the deletion -r\`\`End of the deletion
3. use the token to upload the Begin of the insertion`.htaccess`End of the insertion Begin of the deletion .htaccessEnd of the deletion file Begin of the insertion`curlEnd of the insertion Begin of the deletion curlEnd of the deletion -XPOST Begin of the insertion'http://localhost/nextcloud-server/index.php/apps/integration_openproject/direct-upload/'$TOKENEnd of the insertion Begin of the deletion 'http://localhost/nextcloud-server/index.php/apps/integration\_openproject/direct-upload/'$TOKENEnd of the deletion --form Begin of the insertion'file=@"/tmp/.htaccess"'End of the insertion Begin of the deletion 'file=@"/tmp/.htaccess"'End of the deletion --form Begin of the insertion'overwrite="true"' -H'Content-Type: multipart/form-data' -v`End of the insertion Begin of the deletion 'overwrite="true"' -H'Content-Type: multipart/form-data' -vEnd of the deletion

### What is the buggy behavior?

_Please describe the bug with as most details as possible. Example:_

* HTTP response code is 500

### What is the expected behavior?

_Describe how the application should behave like. Example:_

1. HTTP response code 403